What does Windows error code 8608 (ERROR_DS_CANT_MOVE_APP_BASIC_GROUP) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: A non-empty basic application group cannot be moved across domain boundaries.

Previous	Next
ERROR_DS_GROUP_CONVERSION_ERROR	ERROR_DS_CANT_MOVE_APP_QUERY_GROUP

ERROR_DS_CANT_MOVE_APP_BASIC_GROUP

ERROR_DS_CANT_MOVE_APP_BASIC_GROUP (8608) is an Active Directory Domain Services error. The directory service rejected a cross-domain move of a non-empty basic application group. Its members and application-specific authorization rules cannot be preserved by treating the group as an ordinary movable object.

What to check

Document the group members, nesting, resource permissions, and application dependencies.
Create a suitable equivalent in the target domain and migrate access in a controlled sequence.
Test authorization after the change before retiring the original group.

Useful command

Get-ADGroupMember -Identity "<ApplicationGroup>" -Recursive

Microsoft: Understand Active Directory security groups · Microsoft: Move-ADObject · Microsoft: Directory Service system error codes

Looking for a different code? Search another status or error code.